I ping R4 from R3 and and trafic goes through R1 (with higher HSRP priority) and if I shutdown interface on R1 I have to wait 2-4 minutes till the tunnel up between R2<->R3. Meantime I see messages on R2 (~10x) :

*Apr 30 22:09:35.071: %CRYPTO-4-IKMP_NO_SA: IKE message from 10.0.0.3 has no SA and is not an initialization offer

I thought that SSO functionality keeps the information about the neighboor tunnel and can take the role very fast.

My question: is it OK that the process takes couple of minutes or can be something wrong with my SSO configuration ?